EP3506587A1 - Integrated circuit - Google Patents

Integrated circuit Download PDF

Info

Publication number
EP3506587A1
EP3506587A1 EP17211231.0A EP17211231A EP3506587A1 EP 3506587 A1 EP3506587 A1 EP 3506587A1 EP 17211231 A EP17211231 A EP 17211231A EP 3506587 A1 EP3506587 A1 EP 3506587A1
Authority
EP
European Patent Office
Prior art keywords
network interface
interface processor
data
network
integrated circuit
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Withdrawn
Application number
EP17211231.0A
Other languages
German (de)
English (en)
French (fr)
Inventor
Fabien Gremaud
Brecht Wyseur
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Nagravision SARL
Original Assignee
Nagravision SA
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Nagravision SA filed Critical Nagravision SA
Priority to EP17211231.0A priority Critical patent/EP3506587A1/en
Priority to ES18826059T priority patent/ES2971640T3/es
Priority to EP18826059.0A priority patent/EP3732847B1/en
Priority to CN202310339928.1A priority patent/CN116366341A/zh
Priority to SG11202005555XA priority patent/SG11202005555XA/en
Priority to CN201880082813.6A priority patent/CN111656747B/zh
Priority to PCT/EP2018/086570 priority patent/WO2019129704A1/en
Priority to BR112020012821-0A priority patent/BR112020012821A2/pt
Priority to US16/958,069 priority patent/US11271901B2/en
Publication of EP3506587A1 publication Critical patent/EP3506587A1/en
Withdrawn legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/105—Multiple levels of security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/32—Flow control; Congestion control by discarding or delaying data units, e.g. packets or frames
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0209—Architectural arrangements, e.g. perimeter networks or demilitarized zones
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0272—Virtual private networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H04L9/0897—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/12—Details relating to cryptographic hardware or logic circuitry
    • H04L2209/127—Trusted platform modules [TPM]

Definitions

  • the present disclosure relates to an integrated circuit, in particular, to an integrated circuit which provides for secure communication between two networks, for example where one network is a secure network and the other is a public network.
  • a major challenge in internet of things (loT) and other kinds of network security is how to securely connect devices and networks and to protect operations across the networks whist maintaining functionality.
  • OT secure operational technology
  • the challenge is to protect the OT network from intrusions originating from the public network.
  • a specific example of an OT network is a network of sensors which are part of a control system for a power station.
  • the data generated by sensors in the sensor network of the power station control system may be sensitive, valuable and/or mission critical, so that tampering with the sensor data could represent security and safety risks.
  • the data itself and operations on data produced by sensors in the network of sensors (such as the authentication mechanisms) need to be protected against cyber-attacks that originate from an insecure network with which the network of the sensors is in communication.
  • an integrated circuit in accordance with the disclosure comprises first and second network interface processors which are separate processors and which are connected by a first unidirectional interconnect.
  • the first unidirectional interconnect allows data transfer from the first network interface processor to the second network interface processor, while preventing data transfer in the reverse direction.
  • the first network interface processor is for communication with a first network which may be a secure network and the second network interface processor is for communication with second network which may be a public network, for example an insecure public network.
  • the processing of data received from each of the first and second networks is performed by separate processors and data can only be sent from the first network to the second network, thereby protecting the first network from the second network.
  • an integrated circuit comprising a first network interface processor for communicating with a first network and a second network interface processor for communicating with a second network.
  • the second network interface processor is a separate processor from the first network interface processor.
  • a first unidirectional interconnect connecting the first and second network interface processors is also provided.
  • the first unidirectional interconnect is configured to allow data transfer from the first network interface processor to the second network interface processor via the first unidirectional interconnect and to prevent data transfer from the second network interface processor to the first network interface processor via the first unidirectional interconnect.
  • the first network interface processor is configured to transmit data to the second network interface processor via the first unidirectional interconnect and the second network interface processor is configured to receive data from the first network interface processor via the first unidirectional interconnect.
  • the first network which may be a secure network
  • the second network which may be a public network
  • any devices of the first network such as sensors, are protected from the public second network by the integrated circuit.
  • the processing of network communication is separated onto a dedicated processor for each of the two networks, the processors being connected by the first unidirectional interconnect, providing further security.
  • provision of this functionality in the form of an integrated circuit is both an inexpensive and scalable mechanism for enabling secure communication from a first to a second network.
  • the first unidirectional interconnect may comprise a first data diode configured to allow data transfer from the first network interface processor to the second network interface processor via the first unidirectional interconnect and to prevent data transfer from the second network interface processor to the first network interface processor via the first unidirectional interconnect.
  • the first data diode may be an optical data diode.
  • a data diode allows a "one-direction data flow". It will be well understood that an optical diode is a non-limiting example, and that a hardware register with respective read-only and write-only interfaces, a unidirectional hardware bus or a unidirectional hardware bus with master write-only and slave read-only interfaces may be used.
  • a data diode may also be a double access ram with one side limited to write function and another side limited to a read function, and the like.
  • the first unidirectional interconnect further may comprise a first switch configured to disable the first unidirectional interconnect such that no data transfer between the first network interface processor and the second network interface processor via the first unidirectional interconnect is possible when the first switch is open.
  • a first switch configured to disable the first unidirectional interconnect such that no data transfer between the first network interface processor and the second network interface processor via the first unidirectional interconnect is possible when the first switch is open.
  • data flow from the first network interface processor to the second network interface processor via the first unidirectional interconnect can be prevented via operation of the switch. This enables full control of data flow through the first unidirectional interconnect as opening of the switch physically disables the first unidirectional interconnect.
  • the integrated circuit may further comprise a secure area, for example a hardware root of trust, configured to control operation of the first switch.
  • control of the first unidirectional interconnect is fully managed by the secure area and configuration of the data flow between first and second networks via the first unidirectional interconnect can be controlled securely.
  • the integrated circuit may be configured to generate authentication data for data received at the first network interface processor from the first network.
  • data received at the first network interface processor from the first network can be provided with associated authentication data such that it can be authenticated by a recipient by verifying the authentication data, where the recipient is in possession of an appropriate verification function.
  • an authenticating function may be used to provide authentication data and the recipient may be in possession of a verification function which can be used to verify the authentication data, thereby authenticating the data with which the authentication data is associated.
  • data produced by first networks which do not comprise any means for providing authentication data can be provided with associated authentication data by the integrated circuit, by which the data can be authenticated.
  • the integrated circuit may further comprise a second unidirectional interconnect connecting the first and second network interface processors.
  • the second unidirectional interconnect is configured to allow data transfer from the second network interface processor to the first network interface processor via the second unidirectional interconnect and to prevent data transfer from the first network interface processor to the second network interface processor via the second unidirectional interconnect.
  • the second network interface processor may be configured to transmit data to the first network interface processor via the second unidirectional interconnect and the first network interface processor may be configured to receive data from the second network interface processor via the second unidirectional interconnect.
  • the second unidirectional interconnect may comprise a second data diode configured to allow data transfer from the second network interface processor to the first network interface processor via the second unidirectional interconnect and to prevent data transfer from the first network interface processor to the second network interface processor via the second unidirectional interconnect.
  • the second data diode may be an optical data diode
  • the second unidirectional interconnect may further comprise a second switch configured to disable the second unidirectional interconnect such that no data transfer between the first network interface processor and the second network interface processor via the second unidirectional interconnect is possible when the second switch is open.
  • the secure area is configured to control operation of the second switch.
  • data flow from the second network interface processor to the first network interface processor via the second unidirectional interconnect can be prevented via operation of the second switch.
  • This enables full control of data flow through the first unidirectional interconnect as opening of the switch physically disables the first unidirectional interconnect.
  • the integrated circuit may be configured to only permit transmission of data of a predetermined size via the second unidirectional interconnect, for example the size may be limited to the size of one or more of acknowledgement or negative-acknowledgement signals.
  • the second unidirectional interconnect can be configured to have a very specific limited purpose. For example, only a single bit of data confirming that a piece of data passed from the first network interface processor to the second network interface processor, via the first unidirectional interconnect, has been successfully transmitted may be permitted to be sent in the reverse direction via the second unidirectional interconnect.
  • the secure area may be configured to control operation of the second switch.
  • control of the second unidirectional interconnect is fully managed by the secure area and configuration of the data flow between first and second networks via the second unidirectional interconnect can be controlled securely.
  • the integrated circuit may be configured to authenticate data received at the second network interface processor from the second network by verifying authentication data associated with the received data.
  • the received data may be decrypted by the second network using a key issued by the secure area.
  • data received at the second network interface processor can be authenticated using corresponding authentication data, where the integrated circuit is in possession of the appropriate verification function.
  • the integrated circuit may be configured to prevent the associated data from being sent to the first network interface processor from the second interface processor.
  • only data which has been successfully authenticated can be transmitted from the second interface processor to the first interface processor.
  • the secure area has specific non-reversible memory configuration so that depending on its non-reversible configuration, the secure area forces the switch(es) in a permanent and non-reversible lock of the direction.
  • the switches may be one-time programmable (OTP) switches which can be locked in an open or a closed position, after which it is not possible to alter the state of the switches.
  • OTP switches includes a fuse which can be blown to prevent further operation of the switches or to disable the corresponding interconnect of each switch.
  • a memory location in the secure area that can be written to once can be provided.
  • the desired configuration of the switch or switches can be written to the memory location and the configuration of the switches is then fixed.
  • the secure area for example the memory location, has a specific non-reversible memory configuration. Depending on its non-reversible configuration, the secure area forces the switch(es) to be "open” so either direction can be permanently disabled with the respective switch locked to an open position. In other words, the secure area forces the switch(es) to a permanent and non-reversible lock of the respective direction.
  • such an integrated circuit is configurable in that, before the OTP switch or switches have been locked in any one position, a decision as to desired states for either or both of the switches can be made, and the OTP switch or switches can be locked into the desired state.
  • a "unidirectional interconnect” is an interconnect on an integrated circuit which permits transmission of data in a first direction along the interconnect and prevents transmission of data in the reverse direction.
  • a “data diode”, as understood in the art, allows one way transmission of data through it.
  • the first data diode of the first unidirectional interconnect allows data to be transmitted from the first network interface processor to the second network interface processor but prevents data transmission in the reverse direction.
  • An example data diode is an optical data diode which comprises a light source, such as an LED, the light output of which is incident upon a light sensor, such as a phototransistor.
  • the first network interface processor may be in communication with the light source and the second network interface processor may be in communication with the light sensor.
  • Data can be transmitted from the first network interface processor to the light source which can transmit the data to the second network interface processor via the light sensor. It will be apparent that the light sensor is unable to transmit data to the light source and, as such, data cannot travel in the reverse direction. In this way, diode like functionality is provided.
  • integrated circuit has its conventional meaning, namely it is a circuit in which all or some of the circuit elements are inseparably associated and electrically interconnected so that it is considered to be indivisible for the purposes of construction and commerce.
  • An example of an integrated circuit is a "system on a chip” (SOC).
  • SOC is an integrated circuit in which all the components needed for a computer or other system are included on a single chip. All of the embodiments of the integrated circuits described herein could, in some embodiments, be a system on a chip.
  • the second network interface processor being "separate" from the first network interface processor requires that the processors are separate entities on the integrated circuit. For example, they may be located at separate areas of a substrate of the integrated circuit and only be connected by one or more of the first and second interconnects described herein.
  • An OT network enables communication between hardware and software dedicated to detecting or causing changes in physical processes through direct monitoring and/or control of physical devices such as sensors, valves, pumps, and the like.
  • OT networks enable computer systems to monitor or alter the physical state of a system. Examples include control system networks for a power station or the control network for a rail system.
  • Authentication data is any data which enables data, such as sensor data produced by a sensor in the first network, to be authenticated.
  • a "digital signature” is one such example.
  • a digital signature is a mathematical scheme for demonstrating the authenticity of digital messages or documents, such as data packets.
  • a message authentication code (MAC) data tag is another example of authentication data.
  • authentication data has been "verified”, this is to be understood to mean that a verification function, for example of the types described herein, has been used to determine that the authentication data is as expected hence authenticating data associated with the authentication data.
  • An “acknowledgement signal” is a signal sent by a recipient of data to signify receipt of the data.
  • a “negative-acknowledgement signal” an intended recipient of data to indicate a rejection received data or to indicate some kind of error, for example where a missing data packet in a series of data packets has been detected by the intended recipient.
  • a "secure area” is a secure region of the integrated circuit. Examples include a trusted execution environment (TEE), such as a hardware root of trust.
  • TEE trusted execution environment
  • the secure area is an area in which code and data loaded inside it are protected with respect to confidentiality and integrity.
  • TEE trusted execution environment
  • applications running in the TEE are named trusted applications and they can provide services such as secure storage (for example, of cryptographic keys) and cryptographic operations (for example, authentication functions, verification functions and key generation algorithms).
  • a "hardware root of trust” is a TEE which is implemented in hardware, such as the Synopsys tRoot. Malware cannot tamper with the functions provided by hardware roots of trust as they are implemented in hardware.
  • an integrated circuit 104 is in communication with a first network 102.
  • the first network 102 is a secure, for example an operational technology (OT) or private, network of sensors 108 which output measurement data.
  • the output measurement data may relate to pressure, temperature, radioactivity, current, voltage, weight, flow, humidity, acceleration and/or positioning data, amongst other things.
  • the integrated circuit 104 is also in communication with a second network 106.
  • the second network 106 is a public, and hence less secure, network, such as the internet.
  • the second network 106 is in further communication with a computer system 110 for further processing the measurement data output of sensors 108 in communication with the first network 102.
  • sensors 108 could equally be any device which comprises a data source suitable for providing output data.
  • the integrated circuit 104 comprises a first network interface processor 202, a second network interface processor 204, a first unidirectional interconnect 206 comprising a first data diode 210a and a first switch 212a, a second unidirectional interconnect 208 comprising a second data diode 210b and a second switch 212b, a secure area 214, and an authentication module 216.
  • the authentication module 216 may verify the authenticity of the data received by the secured environment or secure network 102. It may also generate authenticity for the data generated by the secured environment 102. It may also decrypt the data received by the secured network 102. It may also encrypt the data sent by the secure network 102. Each function may be configured independently with one direction with specific keys/configurations and the other direction with other keys/configurations.
  • the first network interface processor 202 is arranged to communicate with the first network 102. Measurement data from sensors 108 in communication with the first network 102 is received by the first network interface processor 202.
  • the second network interface processor 204 is a separate processor from the first network interface processor 202 such that two distinct processing environments are provided.
  • the first unidirectional interconnect 206 and the second unidirectional interconnect 208 are the only communication paths between the first network interface processor 202 and the second network interface processor 204.
  • the first unidirectional interconnect 206 is the only communication path between the first network interface processor 202, for example where no second unidirectional interconnect 208 is provided or where the second unidirectional interconnect 208 has been disabled via the mechanisms described herein.
  • Each of the first unidirectional interconnect 206 and the second unidirectional interconnect 208 respectively comprise a first data diode 210a and second data diode 210b, as well as a first switch 212a and a second switch 212b.
  • the first data diode 210a is arranged to allow data to be transmitted from the first network interface processor 202 to the second network interface processor 204 via the first unidirectional interconnect 206 and prevent data from being transmitted in the reverse direction.
  • the second data diode 210b is arranged to allow data to be transmitted from the second network interface processor 204 to the first network interface processor 202 via the second unidirectional interconnect 208 and prevent data from being transmitted in the reverse direction.
  • first and second data diodes 210a 210b in order to provide the unidirectional functionality of the first and second interconnects 206 208, other mechanisms may be used to provide the unidirectional functionality.
  • the first switch 212a is arranged to disable the first unidirectional interconnect 206 such that no data transfer between the first network interface processor 202 and the second network interface processor 204 is possible via the first unidirectional interconnect 206 when the first switch 212a is open. When the first switch 212a is closed, data transfer is possible.
  • the second switch 212b is arranged to disable the second unidirectional interconnect 208 in the same way that the first switch 121a is arranged disable the first unidirectional interconnect 206.
  • the operation of the first and second switches 212a, 212b is controlled by the secure area 214.
  • the first switch 212a switch and/or the second switch 212b are OTP based switches which can be locked in an open or a closed state using an OTP, after which it is not possible to alter the state of the switch.
  • the second network interface processor 204 is arranged to communicate with the second network 106. For example, measurement data received by the first network interface processor 202 and communicated to the second network interface processor 204 via the first unidirectional interconnect 206 may be sent by second network interface processor 204 to a computer system 110 via the second network 106 for further processing.
  • the first unidirectional interconnect 206 is the only communication path between the first network interface processor 202 and the second network interface processor 204 as either no second unidirectional interconnect 208 is provided or the second unidirectional interconnect 208 has been disabled by opening of the second switch 212b. In this way, the first network interface processor 202, and therefore the first network 102, is shielded from the second network 106 as no data from second network 106 can be received by the first network interface processor 202.
  • the second unidirectional interconnect 208 may be configured to only permit transmission of data of a predetermined size and/or nature. For example, only one or more of an acknowledgement or negative-acknowledgement signal may be transmitted via the second unidirectional interconnect 208.
  • An acknowledgement or negative-acknowledgement signal may be issued by the computer system 110 in response to receipt of measurement data from the one or more sensors 108.
  • An acknowledgement signal may be generated and sent when the computer system 110 successfully receives a particular piece of data from the one or more sensors 108 and a negative-acknowledgement signal may be generated and sent to reject a received piece of data from the one or more sensors 108, or to indicate an error in the received piece of data.
  • Each of the acknowledgement or negative-acknowledgement signals may be a few bits in size, for example 1, 2 or 3 bits in size. Accordingly, the integrated circuit 104 may be arranged to only allow transmission of data of 3 or less bits in size via the second unidirectional interconnect 208. Any malicious data would likely have more bits than the maximum permitted size and could not be transmitted to the first network interface processor 202 interfacing with the first network 102via the second unidirectional interconnect 208. Therefore, the first network 102 remains protected from any malicious messages exceeding the maximum permitted size.
  • the secure area 214 is arranged to control operation of the first switch 212a and the second switch 212. As such, the configuration of data flow across the integrated circuit 104 can be controlled securely by the secure area 214.
  • the secure area 214 may be a trusted execution environment TEE implemented in software, such as a secure enclave or a separated dedicated secure processor to execute trusted and secure software.
  • the secure area 214 may be a trusted execution environment implemented in hardware, such as a hardware root of trust.
  • the authentication module 216 is arranged to apply cryptographic functions to data received at the first network interface processor 202 from one of the sensors 108 via the first network 102 and to data received at the second network interface processor 204 from the computer system 110 via the second network 106. This may be to verify authentication data associated with the received data or to generate authentication data associated with the received data which can be verified by another entity.
  • the authentication module can also provide data secrecy through encryption functions.
  • the authentication module 216 is part of the secure area 214 such that the cryptographic functions applied by the authentication module 216 are applied within the secure area 214.
  • an authentication function is applied to the data.
  • the authentication function may be a message authentication code (MAC) algorithm, a signing algorithm of a digital signature scheme, or a cryptographic hash function, or an authenticated encryption algorithm that provides both data authenticity and confidentiality such as a Galois/Counter Mode. Any suitable authentication scheme may be used.
  • authentication data can be provided for data received at the second network interface processor 204, such as data sent by the computer system 110.
  • a verification function is used to verify received authentication data.
  • authentication data received at the second network interface processor 204 is not successfully verified by the verification function, it may be prevented from being transmitted to the first network interface processor 202.
  • authentication data received at the first network interface processor 202 such as data sent by one of the sensors 108, can be verified.
  • the authentication module 216 runs the data through a MAC algorithm (which is the authentication function in this example) using a key to produce a MAC data tag (which is the authentication data in this example).
  • the data and the MAC tag are then sent to the computer system 110 by the second network interface processor 204 via second network 106.
  • the computer system 110 in turn runs the received data through the same MAC algorithm (which is the verification function in this example) using the same key, producing a second MAC data tag.
  • the computer system 110 compares the first MAC tag to the second generated MAC tag. If they are identical, the computer system 110 can safely assume that the data was not altered or tampered with during transmission and a degree of data integrity is assured.
  • a MAC algorithm being used to verify authentication data received from the computer system 110 via the second network 106 which is associated with data received from the computer system 110 which is to be transmitted from the second network interface processor 204 to the first network interface processor 202
  • the roles of the authentication module 216 and the computer system 110 are reversed, with the computer system 110 running the data to be sent to the integrated circuit 104 through a MAC algorithm to generate a MAC data tag and, upon receipt of the data and the MAC data tag, the authentication module 216 generating a second MAC data tag and verifying the data in the manner described above.
  • a key generation algorithm first selects a private key uniformly at random from a set of possible private keys.
  • the key generating algorithm is located at the secure area 214.
  • the key generation algorithm outputs the private key and a corresponding public key.
  • the private key is communicated to the authentication module 216 and the public key is communicated to the computer system 110.
  • the authentication module 216 uses a signing algorithm (which is the authentication function in this example) to produce a signature (which is the authentication data in this example) using the data (or, alternatively, a hash or digest of the data) and the private key.
  • the signature is then sent to the computer system 110, for example along with the data.
  • the signature, the data (or a hash or digest of the data from the first data packet where such has been used by the signing algorithm), and public key are run through a signature verifying algorithm (which is the verification function in this example) by the computer system 110, and the authenticity of the data is either accepted or rejected dependent upon the outcome.
  • Cryptographic keys used by the authentication and verification functions may be provisioned by the secure area 214 and may be configured during manufacture of the integrated circuit.
  • the keys may be session keys computed using a key sharing protocol which is common to both the secure area 214 and the recipient of the data subject to the cryptographic function, for example the computer system 110.
  • data transmitted from the first network interface processor 202 to the second network interface processor 204 is provided with authentication data generated by the authentication module 216.
  • the recipient computer system 110 is then able to authenticate the data by verifying the authentication data using a verification function.
  • the authentication module 216 of the integrated circuit 104 can add authentication data to measurement data received from the sensor 108.
  • authentication data can be provided for sensors, and any other devices in communication with the first network 102, which are unable to produce their own authentication data.
  • data transmitted from the second network interface processor 204 to the first network interface processor 202 may be provided with authentication data generated by the authentication module 216.
  • data transmitted from the second network interface processor 204 to the first network interface processor 202 is authenticated by the authentication module 216 by applying a verification function to authentication data associated with the data to verify the authentication data.
  • Data received at the second network interface processor 204 via the second network 106 from the computer system 110 may be authenticated.
  • Authentication data associated with the data can be verified by the authentication module 216 using a verification function so as to authenticate the received data.
  • only data received at the second network interface processor 204 which has been successfully authenticated is permitted to be transmitted from the second network interface processor 204 to the first network interface processor 202.
  • authentication data associated with data received at the first network interface processor 202 may be verified using a verification function by the authentication module 216 to authenticate the data.
  • the secure area 214 comprises a processor 302, a memory 304, a switch control module 306, and a key management module 308.
  • the processor 302 is arranged to coordinate between the switch control module 306 and a key management module 308.
  • the memory 304 can store instructions for execution by the processor 302 to cause the processor 302 to provide desired functionality.
  • the authentication module 216 is also part of the secure area 214: a non volatile memory may be integrated to store Root keys such as OTP cells and/or some hardware crypto blocks
  • the secure area 214 is a secure region of the integrated circuit 104.
  • the secure area 214 is an area in which code and data loaded inside it are protected with respect to confidentiality and integrity.
  • the secure area 214 may comprise an isolated execution environment with processing and memory resources separate and isolated from rest of the integrated circuit. Access to the secure area 214 may be via secure mailbox arrangement.
  • the secure area 214 is a trusted execution environment (TEE) implemented as an isolated environment integrated within the wider environment of integrated circuit 104.
  • TEE trusted execution environment
  • Applications running in the TEE are named trusted applications as they are protected with respect to confidentiality and integrity and can be executed within the isolated environment of the secure area 214.
  • the secure area 214 is a hardware root of trust is a TEE which is implemented in hardware, such as the Synopsys tRoot. Malware cannot tamper with the functions provided by hardware roots of trust as they are implemented in hardware.
  • the secure area 214 is a trusted execution environment, for example, a hardware root of trust, such as the such as the Synopsys tRoot.
  • the switch control module 306 is arranged to securely control operation of the first switch 212a and the second switch 212b as control operations for the switches are performed within the secure are 214.
  • the key management module 308 is arranged to provide the authentication module 216 with cryptographic keys required to encrypt and/or decrypt data as described above. In some embodiments, the key management module 308 is arranged to provide the computer system 110 with cryptographic keys required to encrypt and/or decrypt data as described above.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Small-Scale Networks (AREA)
  • Storage Device Security (AREA)
EP17211231.0A 2017-12-29 2017-12-29 Integrated circuit Withdrawn EP3506587A1 (en)

Priority Applications (9)

Application Number Priority Date Filing Date Title
EP17211231.0A EP3506587A1 (en) 2017-12-29 2017-12-29 Integrated circuit
ES18826059T ES2971640T3 (es) 2017-12-29 2018-12-21 Circuito integrado
EP18826059.0A EP3732847B1 (en) 2017-12-29 2018-12-21 Integrated circuit
CN202310339928.1A CN116366341A (zh) 2017-12-29 2018-12-21 集成电路
SG11202005555XA SG11202005555XA (en) 2017-12-29 2018-12-21 Integrated circuit
CN201880082813.6A CN111656747B (zh) 2017-12-29 2018-12-21 集成电路
PCT/EP2018/086570 WO2019129704A1 (en) 2017-12-29 2018-12-21 Integrated circuit
BR112020012821-0A BR112020012821A2 (pt) 2017-12-29 2018-12-21 circuito integrado
US16/958,069 US11271901B2 (en) 2017-12-29 2018-12-21 Integrated circuit

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
EP17211231.0A EP3506587A1 (en) 2017-12-29 2017-12-29 Integrated circuit

Publications (1)

Publication Number Publication Date
EP3506587A1 true EP3506587A1 (en) 2019-07-03

Family

ID=60990608

Family Applications (2)

Application Number Title Priority Date Filing Date
EP17211231.0A Withdrawn EP3506587A1 (en) 2017-12-29 2017-12-29 Integrated circuit
EP18826059.0A Active EP3732847B1 (en) 2017-12-29 2018-12-21 Integrated circuit

Family Applications After (1)

Application Number Title Priority Date Filing Date
EP18826059.0A Active EP3732847B1 (en) 2017-12-29 2018-12-21 Integrated circuit

Country Status (7)

Country Link
US (1) US11271901B2 (zh)
EP (2) EP3506587A1 (zh)
CN (2) CN116366341A (zh)
BR (1) BR112020012821A2 (zh)
ES (1) ES2971640T3 (zh)
SG (1) SG11202005555XA (zh)
WO (1) WO2019129704A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3852334A1 (en) * 2020-01-20 2021-07-21 Fundacja "Blockchain Development Foundation" A system and a method for secure data transfer using air gapping hardware protocol
US11212084B2 (en) 2018-07-21 2021-12-28 Fundacja “Blockchain Development Foundation” System and a method for signing transactions using air-gapped private keys
GB2610850A (en) * 2021-09-17 2023-03-22 Pa Knowledge Ltd Method and device

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220167846A1 (en) * 2019-03-22 2022-06-02 Sibel Inc. Wireless communication system for wearable medical sensors
CN112822029A (zh) * 2021-02-03 2021-05-18 广州市保伦电子有限公司 一种可阻挡外界信号的录音采集方法、模块和装置
US11709970B1 (en) 2022-12-19 2023-07-25 Fend Incorporated One-way communication data diode on a chip
US20240236057A1 (en) * 2023-01-10 2024-07-11 Rosemount Aerospace Inc. System and method for a secure unidirectional network interface

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8046571B1 (en) * 2006-12-18 2011-10-25 Marvell International Ltd. System-on-a-chip (SoC) security using one-time programmable memories
US20170004318A1 (en) * 2015-06-30 2017-01-05 The United States Of America As Represented By The Secretary Of The Navy Secure unrestricted network for innovation
US20170272455A1 (en) * 2015-06-04 2017-09-21 Vm-Robot, Inc. Routing Systems and Methods

Family Cites Families (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR2922705B1 (fr) * 2007-10-23 2011-12-09 Sagem Defense Securite Passerelle bidirectionnelle a niveau de securite renforce
WO2010013092A1 (en) * 2008-07-30 2010-02-04 Telefonaktiebolaget Lm Ericsson (Publ) Systems and method for providing trusted system functionalities in a cluster based system
EP2173060B1 (en) * 2008-10-02 2012-09-12 VirtualLogix SA Virtualized secure networking
US8429735B2 (en) * 2010-01-26 2013-04-23 Frampton E. Ellis Method of using one or more secure private networks to actively configure the hardware of a computer or microchip
CN201774551U (zh) * 2010-08-25 2011-03-23 上海神计信息系统工程有限公司 两物理隔断网络即时通讯数据摆渡传输器
CN202759475U (zh) * 2012-04-28 2013-02-27 上海杰之能信息科技有限公司 数据发送装置、数据接收装置、数据传输系统以及服务器
CN102929329B (zh) * 2012-09-28 2015-04-08 无锡江南计算技术研究所 片上系统间互连网络的动态重构方法
US8898227B1 (en) * 2013-05-10 2014-11-25 Owl Computing Technologies, Inc. NFS storage via multiple one-way data links
EP2916511B1 (en) * 2014-03-07 2020-02-12 Airbus Opérations SAS High assurance security gateway interconnecting different domains
DE102015205833A1 (de) * 2015-03-31 2016-10-06 Siemens Aktiengesellschaft Einweg-Koppelvorrichtung, Anfrageeinrichtung und Verfahren zum rückwirkungsfreien Übertragen von Daten
CN105282172B (zh) * 2015-11-09 2018-04-20 珠海市鸿瑞软件技术有限公司 基于硬件数据变换技术的单处理系统及网络安全隔离方法
IL250010B (en) * 2016-02-14 2020-04-30 Waterfall Security Solutions Ltd Secure connection with protected facilities
US10791100B2 (en) * 2017-03-10 2020-09-29 Ovsecure Ltd. Systems, methods and devices for secure routing and recording of network data transported through network switch
DE102017117604B4 (de) * 2017-08-03 2019-06-19 Kriwan Industrie-Elektronik Gmbh Verfahren zum Betreiben wenigstens eines Elektromotors und/oder einer damit gekoppelten, nichtfahrenden Arbeitsmaschine sowie eine nichtfahrende Arbeitsmaschine
US10701107B2 (en) * 2017-12-06 2020-06-30 Nicira, Inc. Deterministic load balancing of IPSec processing

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8046571B1 (en) * 2006-12-18 2011-10-25 Marvell International Ltd. System-on-a-chip (SoC) security using one-time programmable memories
US20170272455A1 (en) * 2015-06-04 2017-09-21 Vm-Robot, Inc. Routing Systems and Methods
US20170004318A1 (en) * 2015-06-30 2017-01-05 The United States Of America As Represented By The Secretary Of The Navy Secure unrestricted network for innovation

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11212084B2 (en) 2018-07-21 2021-12-28 Fundacja “Blockchain Development Foundation” System and a method for signing transactions using air-gapped private keys
EP3852334A1 (en) * 2020-01-20 2021-07-21 Fundacja "Blockchain Development Foundation" A system and a method for secure data transfer using air gapping hardware protocol
WO2021148461A1 (en) * 2020-01-20 2021-07-29 Fundacja "Blockchain Development Foundation" A system and a method for secure data transfer using air gapping hardware protocol
US11687478B2 (en) 2020-01-20 2023-06-27 Bitfold Ag System and a method for secure data transfer using air gapping hardware protocol
GB2610850A (en) * 2021-09-17 2023-03-22 Pa Knowledge Ltd Method and device
WO2023041923A1 (en) * 2021-09-17 2023-03-23 Pa Knowledge Limited Method and device for unidirectional data transfer

Also Published As

Publication number Publication date
EP3732847C0 (en) 2024-01-24
SG11202005555XA (en) 2020-07-29
WO2019129704A1 (en) 2019-07-04
CN111656747B (zh) 2023-04-04
US11271901B2 (en) 2022-03-08
EP3732847A1 (en) 2020-11-04
EP3732847B1 (en) 2024-01-24
CN116366341A (zh) 2023-06-30
ES2971640T3 (es) 2024-06-06
BR112020012821A2 (pt) 2020-11-24
US20210067488A1 (en) 2021-03-04
CN111656747A (zh) 2020-09-11

Similar Documents

Publication Publication Date Title
EP3732847B1 (en) Integrated circuit
US10484365B2 (en) Space-time separated and jointly evolving relationship-based network access and data protection system
Bhatia et al. Data security in mobile cloud computing paradigm: a survey, taxonomy and open research issues
KR20210076007A (ko) 주변 장치
US20050283826A1 (en) Systems and methods for performing secure communications between an authorized computing platform and a hardware component
CN104468606A (zh) 一种基于电力生产控制类系统的可信连接系统和方法
CN112311718A (zh) 检测硬件的方法、装置、设备及存储介质
Labrado et al. Fortifying vehicular security through low overhead physically unclonable functions
Katzenbeisser et al. Security in autonomous systems
Fongen et al. Integrity attestation in military IoT
CN110830507B (zh) 资源访问方法、装置、电子设备及系统
US11909874B2 (en) Secure confidential use of communication session keys
CN111651740B (zh) 一种面向分布式智能嵌入式系统的可信平台共享系统
Asoni et al. Alcatraz: Data exfiltration-resilient corporate network architecture
US20200382521A1 (en) Network security interface component and data transmission method
Bhatt et al. A survey on developing secure iot products
Anderson Securing embedded linux
Murti et al. Security in embedded systems
KR20190102950A (ko) 방범용 CCTV PUF(eFUSE)-Q(T)RNG 단말기를 통한 통신방법
Kirkpatrick et al. Restricted authentication and encryption for cyber-physical systems
García Aguilar et al. A Threat Model Analysis of a Mobile Agent-based system on Raspberry Pi
Liu et al. Secure and Trustworthy Forensic Data Acquisition and Transmission in a Cloud Infrastructure
Shastry et al. 4 Internet of Things Security
Papp Protocol for remote attestation of malware-free state of embedded IoT devices
KR20190102972A (ko) PUF(eFUSE)-TRNG 보안 시스템

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION HAS BEEN PUBLISHED

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

AX Request for extension of the european patent

Extension state: BA ME

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20191219

RBV Designated contracting states (corrected)

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: EXAMINATION IS IN PROGRESS

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION HAS BEEN WITHDRAWN

17Q First examination report despatched

Effective date: 20200515

18W Application withdrawn

Effective date: 20200605